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It is well-known that von Neumann entropy is nonmonotonic unlike Shannon entropy (which is 
monotonically nondecreasing) . Consequently, it is difficult to relate the entropies of the subsystems 
of a given quantum state. In this paper, we show that if we consider quantum secret sharing states 
arising from a class of monotone span programs, then we can partially recover the monotonicity of 
entropy for the so-called unauthorized sets. Furthermore, we can show for these quantum states the 
entropy of the authorized sets is monotonically nonincreasing. 
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I. INTRODUCTION 

In this paper we are motivated by the fact that one 
of the reasons why von Neumann entropy behaves dif- 
ferently from the Shannon entropy is rooted in its non- 
monotonicity. A consequence of this fact is that many 
results and techniques of classical information theory do 
not smoothly generalize; one has to frequently overcome 
the obstacles imposed by the breakdown of monotonic- 
ity, often manifesting in various disguises. In classical 
secret sharing, one makes extensive use of information 
theoretic inequalities to bound the performance of secret 
sharing schemes, see [3-@- In most cases these techniques 
do not appear to carry over to quantum secret sharing 
schemes, at least not easily. Quantum secret sharing has 
grown rapidly since its inception in [tJ ■ Despite the grow- 
ing body of literature on quantum secret sharing, see for 
instance and the references therein, only a few of 

them, most notably [HI, EH, have succeeded in employing 
information theoretic methods for quantum secret shar- 
ing. 

This paper attempts to contribute along this direc- 
tion by studying the von Neumann entropy of subsets 
of a given quantum state. Of course, for an arbitrary 
quantum state we cannot expect a relation similar to the 
Shannon entropy. However, by imposing some restric- 
tions on the quantum states, namely by considering a 
class of quantum secret sharing states, we are able to 
prove something definite. 

Our main result is that if we consider a class of secret 
sharing quantum states, then we can prove that the von 
Neumann entropy is monotonically nondecreasing for cer- 
tain subsystems of the quantum state, namely the unau- 
thorized sets. The secret sharing states that we consider 
in this correspondence are those arising from a realiza- 
tion of the quantum secret sharing scheme via monotone 
span programs in a "normal form". We also show that 
for the subsystems that are authorized, the entropy is 
monotonically nonincreasing. 
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II. BACKGROUND 

Before presenting our main result, we review briefly 
the relevant background. In this paper a quantum se- 
cret sharing scheme refers to a protocol to distribute an 
unknown quantum state to a group of n players so that 
only authorized subsets of players can reconstruct the 
secret quantum state 0-lsl- The state received by any 
participant is called a share. The set of players is de- 
noted as P = {1,2, ... ,n}. The collection of authorized 
sets, denoted as T, is called the access structure and the 
collection of unauthorized sets, denoted A, is called the 
adversary structure. The dual access structure is defined 
as 

r* = {ACP\A<£T}, (1) 

where A = P \ A. 

An access structure T can be realized by a quantum 
secret sharing scheme if and only if it satisfies T C V* , 
see d, Hoj . An access structure is said to be self-dual 
if T = r*. A self-dual access structure can be realized 
as quantum secret sharing scheme so that pure states 
are encoded as pure states; the associated secret sharing 
scheme is said to be a pure-state scheme. If T C V* , 
then the associated secret sharing scheme encodes some 
pure state into a mixed state; such schemes are called 
mixed-state schemes. 

An authorized set is said to be minimal if every proper 
subset of it is unauthorized. Minimal authorized sets 
completely characterize an access structure and we de- 
note the collection of minimal authorized sets of T by 
r . 

x mm- 

A secret sharing scheme is said to be connected if ev- 
ery participant occurs in some minimal authorized set. 
A participant who does not occur in any minimal autho- 
rized set is said to be unimportant and the share asso- 
ciated to that player can be discarded without loss. We 
can assume that the access structure is defined on the re- 
duced set of players excluding the unimportant players. 
In this paper we consider only connected secret sharing 
schemes, in other words, every player is important. 

Closely related to this idea of important share is the no- 
tion of dispensable components of a share [l5j . Suppose a 
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part of the share received by a player does not play a role 
in the reconstruction of the secret in any of the minimal 
authorized sets to which the player belongs, then that 
part of the share can be discarded without any loss. We 
call such parts of the share dispensable components and 
indispensable otherwise. One way to create such compo- 
nents is to distribute additional quantum states that are 
unrelated to the secret. Such components neither aid nor 
hinder a subset's ability to reconstruct the secret. The 
access structure realized by the scheme is unaffected if 
such components of the share are discarded. We assume 
that the secret sharing schemes considered in this paper 
are devoid of such dispensable components in any share. 

Definition 1 (CSS secret sharing schemes). A pure-state 
secret sharing scheme £ is said to be a CSS secret sharing 
scheme if the encoding for the scheme is of the form 

i s >^^Wei sY+c >' ( 2 ) 

V c£C 

where s£F, and I 6 FJ. A mixed-state secret scheme 
is said to be CSS type if it can be obtained by discarding 
one share of a pure-state CSS scheme. 

As mixed-state schemes can be obtained from pure- 
state schemes, see @, without loss of generality we can 
focus our attention on pure-state schemes. In terms of 
access structures this implies we can focus on the self- 
dual access structures. 

Smith proposed a method to realize a quantum secret 
sharing scheme for any quantum access structure using 
monotone span programs. We will need parts of that 
construction to prove our result and therefore provide a 
quick review of the same. Further details can be found 
in [l0|. 

Definition 2 (Montone span program). A monotone 
span program Ai is a triple (W q ,M,t[>) consisting of a 
matrix M £ ¥ q xe over ¥ q and surjective function ijj : 
{1, 2, . . . , d} — >• P. The program is said to accept A C P 
if and only if 

£l = (l,0,...,0)*eim(M^), (3) 

where Ma is the submatrix of AI and consists of all the 
rows that correspond to the participants in A. 

We say M is the span matrix of the span program. 
A monotone span program is said to compute an access 
structure r if M accepts A g V and rejects A £ V. It 
follows that for any unauthorized set B C P, we must 
have Ei ^ Im (Mg). Alternatively, there exists some v = 
(vi,...,v e ) € such that MbV = and v\ ^ 0. 

For every access structure T, we can realize it using 
a monotone span program in a "normal form" . This is 
not necessarily efficient but these realizations provide us 
with the secret sharing states which are central for our 
discussion. We caution the reader that our terminology 
of span programs, especially the usage of normal form for 
monotone span programs, does not follow the standard 
terminology in the literature on span programs. 



Definition 3 (Normal form monotone span program). 
Suppose that r m j n = {A±, . . . Ak} and let \Ai\ — 1 = r\. 
Also let, r = ' s £ ji and c = r — k = X^ r i- ^ e 
monotone span program that computes T mm over ¥ q has 
the span matrix M as given in equation (|4])- The map- 
ping ?p is given as follows: The rows corresponding to 
submatrix I n corresponds to the first \Aj\ — 1 partic- 
ipants of the authorized set A^. The row of the form 
(1, 0, . . . , 0, — 1, 0, . . . , 0) is labeled by the last participant 
of A, and -1 = (-1, ...,-1) e F£«. 
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Classically this matrix defines the encoding for the se- 
cret sharing scheme. The scheme implicitly assumes an 
ordering of the participants and the use of c random vari- 
ables in addition to the secret. For each minimal autho- 
rized set Ai, the scheme distributes s^i, ■ • ■ , Si >Ti and 
s— ^2 j Si j, where Sij for 1 < j < are random variables. 
More precisely, Sij is distributed to the jth player of Ai 
for 1 < j < r,i and s — J2j s i,j to the last player in Aj. 
Considering the distribution scheme for the entire set of 
players we distribute uM , where u = (s, s\, . . . , s c ). In 
the normal form construction, no player is unimportant 
and no share has a dispensable component. 

We make the following useful observations about the 
structure of M as given in equation (f4]). 

i) The rows associated to the players in any authorized 
set arc linearly independent. 

ii) The rank of M is given by 1 + n + ■ ■ ■ + Tk- 

iii) The rows associated with any given participant are 
linearly independent. 

iv) For each column 2 < j < c+1 in M, there are exactly 
two rows in M which have nonzero support on j and 
they both belong to the same authorized set. 

For a vector v = (v\, . . . , v n ) € F™, we refer to the sup- 
port of v as the set of coordinates for which Vi ^ 0. 

In the quantum secret sharing scheme due to Smith 
fioj the encoded state is given by 

\s)^^= £ \uM\ (5) 

where we assume that the u = (s, Sx . . . , s c ) £ F^ +1 . 
Please note that we do not need to use any additional 
random variables in the quantum secret sharing schemes 
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as opposed to the classical schemes. We also note that 
the construction in [ic| will hold for span matrices that 
are not in normal form; however, the associated access 
structure must still be self-dual. The reader might find 
it helpful to refer to a small example given in the ap- 
pendix. 

We denote the von Neumann entropy of a quantum 
state with the density matrix p by S(p) = — Tr(plog 2 p). 
The following relation on the entropies of the autho- 
rized and unauthorized sets of a quantum secret sharing 
scheme realized by monotone span programs was shown 
in [13, Lemma 17]. 

Lemma 1 ([l|). Suppose M = (¥ q ,M,ip) is a mono- 
tone span program realizing a quantum access structure 
r. Let A <E T and B = P \ A. Let rank(M A ) = a. 
rank(A/g) = b and rank(M) = m and S(S) the entropy 
of the secret S . Then we have 

S(A) = (a + b-m)\og 2 q + S(S) (6) 
S(B) = (a + b-m)log 2 q (7) 

III. ENTROPIC INEQUALITIES 

In this section we prove our main result for monotonic- 
ity of entropy for the unauthorized sets of a quantum se- 
cret sharing scheme realized via the construction given 
in the previous section. We need the following lemma. 

Lemma 2. Suppose that Ai = (¥ q ,M, tp) is a monotone 
span program in normal form computing the access struc- 
ture r. Let AU B U {p} = P be a partition of P where 
B G r. Let Ai £ r m ; n be a minimal authorized set that 
contains p. Denote by Af^.j the submatrix of M with 
\Ai\ rows that correspond to the players in Ai. Then one 
of the following holds: 
i) If Ai C A, then any row in M^.y is linearly depen- 
dent in Ma and linearly independent in Ma' > where 
A' = AU_{p}. 

ii) If Ai ^ A, then any row in Miaa is linearly inde- 
pendent in Ma and linearly independent in Ma' ■ 

Proof. Since Ai is authorized, £\ is in im(Af^ ) and there 
exists some linear combination of the rows of Ma { such 
that 

22 R i = £ i) 
3=1 

where Rj are the rows of Ma 4 . Without loss of generality 
let Ri be the row associated with p in A/^.j. Since 
= B is still an authorized set, e\ is also in im(AI B ) 
and there exists a linear combination of rows in B such 
that 

|M B | \Ai\ 

J2PjQo = £i = Ri + J2 R j' 



where Qj are the rows of Mb and \Mb \ denotes the num- 
ber of rows of Mb- Then clearly, Ri can be expressed as 
a linear combination of the rows in Mb ■ 

Next, we show that R\ is independent in Ma 1 - Assume 
that on the contrary that R\ can also be expressed as a 
linear combination of the rows in Ma' (excluding R\). 
Now observe that the rows corresponding to Ai are of 
two types: either they have a single non-zero element 
or they have 1 + |A;| nonzero elements. Permuting if 
necessary we can assume that R\ is of the form / = 
(0,1,0,...,0) e or .9 = (1,-1,0,...,0) e ¥ c +\ 

A necessary condition for R\ be a linear combination 
of rows of Ma 1 is that the support of these rows must 
contain the support of Ry. Keeping in mind that Ai \ 
{p} B = A', we infer that if i?i = /, then no row 
in Ma 1 has overlap with the support of Ry. If Ry = 
g, then some rows of Ma< can have support in the first 
coordinate but not in the next |^4.; | — 1 coordinates, where 
R\ is nonzero. Therefore it must be the case that R\ is 
independent in Ma 1 - This proves the first part of the 
lemma. 

Now let us consider the case when Ai % A. If Ry = g, 
then whether it is in Ma or Ma 1 , the rows in A do not 
contain the support of R\ and similarly the rows in Ma 1 
do not contain the support of Ry . Hence it is independent 
in both Ma and Ma>- If -Ri = /, then g corresponds to 
some other participant p' who is in cither A or A' but not 
both as A' n A = {p} . Thus g is in one of the rows of M a 1 
or Ma but not both. Consequently, R\ is independent in 
one of Ma> or Afj. 

Suppose that both R\ and g are in the same set S, 
where S is either A' ox A. Note that Ai % A and ncithcr 
is Ai % A' because A' ^ T. It follows that M^a { ] must 
contain other rows and the support of g extends beyond 
the support of i?i and the first coordinate. Then since 
g is the only element whose support overlaps with Ri, 
any linear combination of rows that generates R\ must 
include g. We could rewrite this linear combination to 
express g as a linear combination of the elements of S. 
But we have already seen that g is linearly independent 
in both the sets A' and A. Therefore, it follows that such 
a combination does not exist and R± is independent as 
well. This proves the second part of the lemma. □ 

With this preparation we are now ready to prove our 
central result. 

Theorem 1. Suppose that an access structure T is real- 
ized using the normal form monotone span construction. 
Let 4CBC P. Then 

S(A)<S(B) ifA,B?T 

S(A) > S(B) ifA,B e T 1 ' 

Proof. Let us first show this result assuming that T is a 
self-dual access structure. The proof relies on Lemma [T] 
Without loss of generality we can assume that |-B\^4| = 1 
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in other words, B \ A = {p}. Let 

A p = {A, G r min :A,cI and p 6 A.J 
A p = {A, 6 r min : A. t <2 A and p G A.J 

Suppose that A p =^ 0. Then there exists some A; e 
r m in such that p e Ai C A. Consider the rows asso- 
ciated to this set in M, i.e. M^. By Lemma [H this 
row is dependent in Ma and therefore removing it will 
not change the rank of the resulting submatrix. On the 
othcrhand. by the same lemma we know that this row is 
independent in Ma 1 , where A' = A U {p} , therefore the 
rank of the matrix obtained by adding this row to Ma is 
greater by one. 

Repeating this process for all the Ai in A p , we obtain 
a matrix with fewer rows than Ma but having the same 
rank. On the other hand, the rank of the matrix obtained 
by adding these rows to Ma increases for each element 
in A p . 

Now consider an authorized set Ai € A p . Since Ai is 
not a subset of A, it follows that some participant of A; 
must be in A. By LemmaHJ the row associated with p in 
M{Ai} is independent in Ma as well as Ma 1 - Therefore, 
the rank of the submatrix obtained by removing this row 
from Ma diminishes by one while the submatrix obtained 
by adding this row to Ma increases by one. Once again 
repeating this process for all the Ai £ A p we see the 
the rank of Ma> increases by |A P |, while the rank of the 
submatrix obtained by removing all the rows associated 
with p in A p reduces its rank by | AP \ . 

Therefore adjoining to Ma all the rows associated 
with p gives us M§ and while, removing them from 
Ma gives Mb- From the preceding discussion we see 
that rank(M B ) = rank(M j4 ) - \A P \ and rank(Af B ) = 
rank(MA) + \A P \ + \A P \. By Lemma [IJ the entropy of 
B is given by 

= rank(M B ) + rank(Mg) - rank(M) 

log 2 9 

= rank(M^) + \A P \ + \A P \ + rank(M$) -\A*\ 
- rank(M) 

= rank(M^) + rank(M j5 ) - rank(M) + \A P \ 

log 2 q log 2 q 

If \B \ A | > 1, we can inductively apply this argument to 
every consecutive pair of sets in the following chain 

A = B k c £ fe _i C--cBiCB„ = B, 

where |-Bj+i \ Bi\ = 1. Applying to each adjacent pair in 
the above chain gives us 

S(A) < S(B fc _i) <---<S(fli)<S(B). 

This proves the theorem for the case when the access 
structure is self-dual and A,BgT. 

If A C B e T, then we note that both B C A g T and 
we must have S(B) < S(A). But we also know that for 
a self-dual access structure S(A) = S(A) — 5(5*) if A is 



authorized [HGJ]. Therefore, S(B)-S(S) < S(A)-S(5) 
and this proves the theorem when T is self-dual. 

Now suppose that T is not a self-dual access structure, 
then we can purify it to get a self-dual access structure T 
for which equation ([5]) holds. Recall that the authorized 
(unauthorized) sets of T are also authorized (unautho- 
rized) sets of r and the associated shares are obtained 
by tracing out the additional participant used for purifi- 
cation, see [I] for details about purification. Therefore, 
the result holds for any quantum access structure imple- 
mented via the normal form monotone span construc- 
tion. □ 

Corollary 2. For an access structure realized via the 
normal form monotone span construction, the follow- 
ing relations hold: Among the authorized sets the min- 
imal authorized sets of an access structure have maximal 
entropy and among the unauthorized sets the maximal 
unauthorized sets have maximal entropy. 

Please note the the above corollary does not imply 
that all minimal (maximal) authorized (unauthorized) 
sets have the same entropy. Further, along with Lcmma[T] 
it implies that if we consider a minimal authorized set, 
the entropy of the sets obtained by cither adding partici- 
pants or removing participants from the minimal autho- 
rized set will be lower. 



IV. DISCUSSION 

An obvious question is if these results can be extended 
to all quantum secret sharing states arising via mono- 
tone span programs and more generally, to all secret 
sharing states. While this result might be extended to 
other classes of secret sharing states, it does not seem 
to generalize for arbitrary quantum secret sharing states. 
Nonetheless, these results could be prove to be useful and 
provide additional interesting insights into quantum se- 
cret sharing states in that by partly recovering the mono- 
tonicity for the von Neumann entropy we may be able to 
prove new constrained inequalities for the von Neumann 
entropy. 
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Appendix A: An Example 

We provide a small example to illustrate the details of 
the construction of quantum secret sharing schemes from 
monotone span programs. Consider the minimal access 
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structure T m i n = {{1, 2}, {2, 3}, {3, 1}}. The span matrix 
M for this access structure is given by 



M 



1 

1 -1 



1 



1 



The function ip : {1,2,3,4,5,6} — s- P, takes the values 
V(l) = 1, V(2) = 2, V(3) = 1, ift(4) = 3, ^(5) = 3 
and ijj(6) = 1. Following equation ([5]), we find that the 
encoding (up to normalization) for the quantum secret 
sharing scheme is given by 



In general, for self-dual access structures, if we start 
with the empty set and keep adding participants the en- 
tropy first increases until it becomes a minimal autho- 
rized set and then starts decreasing until it reaches S(S), 
giving a "tent-like" characteristic. More precisely con- 
sider the following chain of sets = Bo C B\ C • • ■ C 
B n -i C B n = P, such that \B t \ = 1. Then 

only one of these sets is a minimal authorized set, say 
Bj. If we now plot the entropy of these subsets we typ- 
ically get a plot similar to the figure shown below, with 
S(-Bo) = and S(B n ) = S(5) and the entropy peaking 
at the minimal authorized set Bj. (Please note that the 
figure below is only representative and does not corre- 
spond to any quantum access structure. For simplicity, 
we assume that the secret is a completely mixed state; 
thus S(S) = log 2 q.) 

S(Si)/S(S) t 
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Then by Theorem [T] and Lemma [T] we compute the en- 
tropy for the unauthorized sets {{0}, {1}} is 0, log 2 q re- 
spetively, while for the authorized sets {{1, 2}, {1, 2, 3}} 
it is S(5) +log 2 q and S(S), where S(5) is the entropy of 
the secret. 
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The mixed-state schemes, i.e. those realizing non-self- 
dual access structures, also show a similar but not exactly 
the same "tent-like" behavior in that S(B n ) > S(S). 
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